PT-2022-16775 · Sentcms · Sentcms

Hanayuzu · Published 2022-03-10 · Updated 2022-03-16 · CVE-2022-24652

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sentcms versions 4.0.x

Description The issue allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution in the /admin/upload/upload endpoint.

Recommendations For sentcms versions 4.0.x, consider disabling the file upload functionality in the /admin/upload/upload endpoint until a patch is available to prevent arbitrary file uploads and potential PHP code execution.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-24652

Affected Products

Sentcms

References · 3

• 🔥 https://blog.hanayuzu.top/articles/37dacab4.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-24652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24652 · Security Note